The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-93d6242840 advisory.

    Rebuilt against golang-x-net 0.33.0 for CVE-2024-45338

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-721a8bada2 advisory.

    Update the OVN sources to upstream release v24.09.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-29fc4fefd5 advisory.


    This release contains a number of small improvements and bugfixes, including mitigations for the LOW     severity vulnerability `CVE-2025-24356`.

    ## Bugfixes

    -   Add mitigations for fast-reconnect amplification attacks

        When receiving a data packet from an unknown IP address/port combination, fastd will assume that one     of its connected peers has moved to a new address (for example due to internet lines with dynamic IP, or     roaming between WWAN and a local internet connection) and initiate a reconnect by sending a handshake     packet. This fast reconnect avoids having to wait for a session timeout (up to ~90s) until a new     connection is established.

        Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger     handshake packet (~150 bytes of UDP payload). With fastd v22, this number is doubled, because two     handshakes are sent (one in a pre-v22-compatible format and one in a new L2TP-style format). Including     IPv4 and UDP headers, the resulting amplification factor is roughly 12-13.

        By sending data packets with a spoofed source address to fastd instances reachable on the internet,     this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack.

        fastd has always implemented rate limiting for handshakes to unknown IP addresses and ports to 1     handshake per 15s to avoid this kind of attack, however the rate is limited per-port and not per-address,     thus still allowing handshakes to be sent to all 65535 UDP ports of the same IP address unlimited.

        The issue has been mitigated in fastd v23 by a number of changes:

        -   Rate-limiting has been changed changed to be applied per-address instead of per-port

        -   Only one handshake instead of two handshakes is sent for fast-reconnect (by determining from the     format of the data packet whether a pre-v22 or L2TP-style handshake should be used)

        -   Require at least a full method header instead of just a single byte for a data packet to be     considered valid. This does not have an effect on instances that enable the `null` method (regardless of     `null` being actually in use), as a single-byte UDP packet is a valid `null` keepalive, but for all other     methods the amplification factor is slightly reduced.


        Only fastd instances that allow connections from arbitrary IP addresses are vulnerable. Instances in a     client role that configure their peers using the `remote` config option (which includes the common     deployment as part of the [Gluon](https://github.com/freifunk-gluon/gluon) wireless mesh firmware) will     not respond to unexpected data packets with a handshake and are therefore unaffected.

        `CVE-2025-24356` has been assigned to this issue. The severity of this vulnerability is considered     LOW.

        A GitHub security advisory can be found under [GHSA-pggg-     vpfv-4rcv](https://github.com/neocturne/fastd/security/advisories/GHSA-pggg-vpfv-4rcv).

    -   Fix config loading to fail on `offload l2tp no;` when L2TP offloading is unsupported by the fastd     build or the kernel

    -   Fix assembly Salsa20(/12) implementations accidentally generating the Linux- specific `.note.GNU-     stack` ELF section on non-Linux systems

        This is unlikely to have caused any issues, as other systems should just ignore the unknown section.

    -   Status socket: - Fix interface name information with L2TP offloading - Add per-peer MTU information

    -   Documentation: - Fix incorrect persist interface examples - Improve explanation of `float`     option

    -   Build: - Fix build on macOS (again) - Fix build with Meson 0.49 (the minimum version marked as     supported by fastd)


    ## Other changes

    -   Add support for Indirect Branch Tracking and Shadow Stacks on x86

        The assembly Salsa20(/12) implementations have been marked compatible with IBT and SHSTK, which are     part of Intel CET (Control-flow Enforcement Technology) and can be enabled using the `-fcf-protection` GCC     option.

    -   The file `COPYRIGHT` has been renamed to `LICENSE`

    -   The vendored version of libmnl that is used with `libmnl_builtin=true` has been updated to 1.0.5



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b895b18cfe advisory.


    This release contains a number of small improvements and bugfixes, including mitigations for the LOW     severity vulnerability `CVE-2025-24356`.

    ## Bugfixes

    -   Add mitigations for fast-reconnect amplification attacks

        When receiving a data packet from an unknown IP address/port combination, fastd will assume that one     of its connected peers has moved to a new address (for example due to internet lines with dynamic IP, or     roaming between WWAN and a local internet connection) and initiate a reconnect by sending a handshake     packet. This fast reconnect avoids having to wait for a session timeout (up to ~90s) until a new     connection is established.

        Even a 1-byte UDP packet just containing the fastd packet type header can trigger a much larger     handshake packet (~150 bytes of UDP payload). With fastd v22, this number is doubled, because two     handshakes are sent (one in a pre-v22-compatible format and one in a new L2TP-style format). Including     IPv4 and UDP headers, the resulting amplification factor is roughly 12-13.

        By sending data packets with a spoofed source address to fastd instances reachable on the internet,     this amplification of UDP traffic might be used to facilitate a Distributed Denial of Service attack.

        fastd has always implemented rate limiting for handshakes to unknown IP addresses and ports to 1     handshake per 15s to avoid this kind of attack, however the rate is limited per-port and not per-address,     thus still allowing handshakes to be sent to all 65535 UDP ports of the same IP address unlimited.

        The issue has been mitigated in fastd v23 by a number of changes:

        -   Rate-limiting has been changed changed to be applied per-address instead of per-port

        -   Only one handshake instead of two handshakes is sent for fast-reconnect (by determining from the     format of the data packet whether a pre-v22 or L2TP-style handshake should be used)

        -   Require at least a full method header instead of just a single byte for a data packet to be     considered valid. This does not have an effect on instances that enable the `null` method (regardless of     `null` being actually in use), as a single-byte UDP packet is a valid `null` keepalive, but for all other     methods the amplification factor is slightly reduced.


        Only fastd instances that allow connections from arbitrary IP addresses are vulnerable. Instances in a     client role that configure their peers using the `remote` config option (which includes the common     deployment as part of the [Gluon](https://github.com/freifunk-gluon/gluon) wireless mesh firmware) will     not respond to unexpected data packets with a handshake and are therefore unaffected.

        `CVE-2025-24356` has been assigned to this issue. The severity of this vulnerability is considered     LOW.

        A GitHub security advisory can be found under [GHSA-pggg-     vpfv-4rcv](https://github.com/neocturne/fastd/security/advisories/GHSA-pggg-vpfv-4rcv).

    -   Fix config loading to fail on `offload l2tp no;` when L2TP offloading is unsupported by the fastd     build or the kernel

    -   Fix assembly Salsa20(/12) implementations accidentally generating the Linux- specific `.note.GNU-     stack` ELF section on non-Linux systems

        This is unlikely to have caused any issues, as other systems should just ignore the unknown section.

    -   Status socket: - Fix interface name information with L2TP offloading - Add per-peer MTU information

    -   Documentation: - Fix incorrect persist interface examples - Improve explanation of `float`     option

    -   Build: - Fix build on macOS (again) - Fix build with Meson 0.49 (the minimum version marked as     supported by fastd)


    ## Other changes

    -   Add support for Indirect Branch Tracking and Shadow Stacks on x86

        The assembly Salsa20(/12) implementations have been marked compatible with IBT and SHSTK, which are     part of Intel CET (Control-flow Enforcement Technology) and can be enabled using the `-fcf-protection` GCC     option.

    -   The file `COPYRIGHT` has been renamed to `LICENSE`

    -   The vendored version of libmnl that is used with `libmnl_builtin=true` has been updated to 1.0.5



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-46e6440101 advisory.

    Update the OVN sources to upstream release v24.09.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-cd51e0177b advisory.

    Rebuilt against golang-x-net 0.33.0 for CVE-2024-45338

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2525ddc3f2 advisory.

    Updated to 132.0.6834.159

          * Medium CVE-2025-0762: Use after free in DevTools

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-df3432c3ee advisory.

    Update to 4.9

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e035838041 advisory.

    Update to 4.9

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-54958ff9e2 advisory.

    Rebase to 20.18.2

    Resolves: CVE-2025-22150 CVE-2025-23085 CVE-2025-23083

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-cc8f9d8943 advisory.

    Update to version 18.20.6 (rhbz#2341760) (rhbz#2340936) (rhbz#2300997)

    Resolves CVE-2025-23084

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6e4727185c advisory.

    update to 0.10.4

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-82ba6b8dc5 advisory.

    Updated to 132.0.6834.159

          * Medium CVE-2025-0762: Use after free in DevTools

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e330d34ecc advisory.

        Update to version 18.20.6 (rhbz#2341760) (rhbz#2340936) (rhbz#2300997)

        Resolves CVE-2025-23084

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-bbabead4d7 advisory.

    ## New

    * ASPA support is now always compiled in and available if `enable-aspa` is set. The `aspa` Cargo feature     has been removed. ([#990])
    * If merging mutliple ASPA objects for a single customer ASN results in more than 16,380 provider ASNs,     the ASPA is dropped. (Note that ASPA objects with more than 16,380 provider ASNs are already rejected     during parsing.) ([#996])
    * New `archive-stats` command that shows some statistics of an RRDP archive. ([#982])
    * Re-enabled the use of GZIP compression in HTTP request sent by the RRDP collector. Measures to deal with     exploding data have been implemented in [rpki-rs#319]. ([#997])

    ## Bug fixes

    * Fixed an issue with checking the file names in manifests that let to a crash when non-ASCII characters     are used. ([rpki-rs#320], reported by Haya Schulmann and Niklas Vogel of Goethe University     Frankfurt/ATHENE Center and assigned [CVE-2025-0638])
    * The validation HTTP endpoints now accept prefixes with non-zero host bits. ([#987])
    * Removed duplicate `rtr_client_reset_queries` in HTTP metrics. ([#992] by [@sleinen])
    * Improved disk space consumption of the new RRDP archives by re-using empty space when updating an object     and padding all objects to a multiple of 256 bytes. ([#982])

    [#980]: https://github.com/NLnetLabs/routinator/pull/980     [#982]: https://github.com/NLnetLabs/routinator/pull/982     [#987]: https://github.com/NLnetLabs/routinator/pull/987     [#990]: https://github.com/NLnetLabs/routinator/pull/990     [#992]: https://github.com/NLnetLabs/routinator/pull/992     [#994]: https://github.com/NLnetLabs/routinator/pull/994     [#996]: https://github.com/NLnetLabs/routinator/pull/996     [#997]: https://github.com/NLnetLabs/routinator/pull/997     [#999]: https://github.com/NLnetLabs/routinator/pull/999     [@sleinen]: https://github.com/sleinen     [rpki-rs#319]: https://github.com/NLnetLabs/rpki-rs/pull/319     [rpki-rs#320]: https://github.com/NLnetLabs/rpki-rs/pull/320     [ui-0.4.3]: https://github.com/NLnetLabs/routinator-ui/releases/tag/v0.4.3     [CVE-2025-0638]: https://www.nlnetlabs.nl/downloads/routinator/CVE-2025-0638.txt



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-76fc32d433 advisory.

    Rebase to 20.18.2

    Resolves: CVE-2025-22150 CVE-2025-23085 CVE-2025-23083

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c17ef0f176 advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4b8ab3834c advisory.

    **phpMyAdmin 5.2.2 is released**

    Welcome to the release of phpMyAdmin version 5.2.2, the I should have released this sooner release. This     is primarily a bugfix release but also contains a few security fixes as noted below.

    *    fix possible security issue in sql-parser which could cause long execution times that could create a     DOS attack (thanks to Maximilian Krg)
    *    fix an XSS vulnerability in the check tables feature (**PMASA-2025-1**, thanks to bluebird)
    *    fix an XSS vulnerability in the Insert tab (**PMASA-2025-2**, thanks to frequent contributor Kamil     Tekiela)
    *    fix possible security issue with library code slim/psr7 (**CVE-2023-30536**)
    *    fix possible security issue relating to iconv (**CVE-2024-2961, PMASA-2025-3**)
    *    fix a full path disclosure in the Monitoring tab
    *    issue #18268 Fix UI issue the theme manager is disabled
    *    issue Allow opening server breadcrumb links in new tab with Ctrl/Meta key
    *    issue #19141 Add cookie prefix '-__Secure-' to cookies to help prevent cookie smuggling
    *    issue #18106 Fix renaming database with a view
    *    issue #18120 Fix bug with numerical tables during renaming database
    *    issue #16851 Fix ($cfg['Order']) default column order doesn't have have any effect since phpMyAdmin     4.2.0
    *    issue #18258 Speed improvements when exporting a database
    *    issue #18769 Improved collations support for MariaDB 10.10

    There are many, many more fixes that you can see in the ChangeLog file included with this release or     [online](https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_2/ChangeLog)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-3aa9a75a72 advisory.

    - [Security][CVE-2024-52948] CSRF on 2FA registration
    - [Security] Open redirect vulnerability in logout

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-07901b1995 advisory.

    - [Security][CVE-2024-52948] CSRF on 2FA registration
    - [Security] Open redirect vulnerability in logout

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-2462a2fc4c advisory.

    Rebase to version 2.6.4

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9f92cbc27f advisory.

    January CPU 2025


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e8b9a6b564 advisory.

    Includes security fixes to the crypto/x509 and net/http packages

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-16778d3c88 advisory.

    This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112     and Runtime to version 8.0.12.

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.112.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.12.md


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3dff292265 advisory.

    fix VW_VERSION in compiled code, patch security issues

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-bd8f5a599b advisory.

    This is the January 2025 security and bugfix release for .NET 8.0. It updates the SDK to version 8.0.112     and Runtime to version 8.0.12.

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.112.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.12/8.0.12.md


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-42ee7772e3 advisory.

    Fix for CVE-2024-52531

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7631628ba6 advisory.

    Update to 20240722.1

    - Fix potential integer overflow in hash container create/resize

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2eb86c0cbf advisory.

    This is the January 2025 security and bugfix release for .NET 9.0. It updates the SDK to version 9.0.102     and Runtime to version 9.0.1.

    Release Notes: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.1/9.0.1.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4cb7637c98 advisory.

    fix VW_VERSION in compiled code, patch security issues

    ----

    update to 1.32.7

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0487787cb9 advisory.

    This is the January 2025 security and bugfix release for .NET 9.0. It updates the SDK to version 9.0.102     and Runtime to version 9.0.1.

    Release Notes: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.1/9.0.1.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b21777d1b5 advisory.

    CVE-2024-11029

    Release note: https://www.freeipa.org/release-notes/4-12-3.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-6baf694c75 advisory.

    CVE-2024-11029

    Release note: https://www.freeipa.org/release-notes/4-12-3.html

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-497995b101 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * On certain non-Fedora kernels, `mkstemp` and other functions may not attempt to create multiple     different file names and fail with `EEXISTS`.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-69207650a4 advisory.

    This update addresses two security vulnerabilities:
    * CVE-2025-0395: A buffer overflow may occur in the `assert` function with certain large program names and     `assert` expressions.
    * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program     creates additional threads after fork.
    The following non-security bugs are fixed:
    * Compatibility with certain programs that call `free(environ)` is improved (however, deallocating     `environ` remains undefined in general).
    * Crashes in string functions on certain hypervisors that report L3 cache sizes above 4 GiB are avoided.
    * Poor performance of x86-64 string functions in certain cases.
    * Initialization of the restartable sequence area now follows recommended practices.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5d89c826ff advisory.

    Update to 132.0.6834.110

      * High CVE-2025-0611: Object corruption in V8
      * High CVE-2025-0612: Out of bounds memory access in V8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-11277f6779 advisory.

    https://lists.wikimedia.org/hyperkitty/list/wikitech-     l@lists.wikimedia.org/thread/PFTE5RHUERS6KTUGGRZO7XXV5THNJ77E/

    https://lists.wikimedia.org/hyperkitty/list/mediawiki-     announce@lists.wikimedia.org/thread/5NYC4UZLY3MWQZ6DYJAUQRJG2ZHZFBJ6/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-25b16d6561 advisory.

    https://lists.wikimedia.org/hyperkitty/list/wikitech-     l@lists.wikimedia.org/thread/PFTE5RHUERS6KTUGGRZO7XXV5THNJ77E/

    https://lists.wikimedia.org/hyperkitty/list/mediawiki-     announce@lists.wikimedia.org/thread/5NYC4UZLY3MWQZ6DYJAUQRJG2ZHZFBJ6/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eb2f4a2306 advisory.

    Update to 132.0.6834.110

      * High CVE-2025-0611: Object corruption in V8
      * High CVE-2025-0612: Out of bounds memory access in V8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b28759cb95 advisory.

    New version 3.4.1, a couple of fixes for the 3.4.0 release.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-908dfe95f6 advisory.

    Security fix for CVE-2024-11218 - fixed in buildah 1.38.1, podman 5.3.2

    Automatic update for buildah-1.38.1-1.fc41, containers-common-0.61.1-1.fc41, podman-5.3.2-1.fc41.

    ##### **Changelog for buildah**

    ```
    * Tue Jan 21 2025 Packit <hello@packit.dev> - 2:1.38.1-1
    - Update to 1.38.1 upstream release

    ```

    ##### **Changelog for containers-common**

    ```
    * Thu Jan 16 2025 Packit <hello@packit.dev> - 5:0.61.1-1
    - Update to 0.61.1 upstream release

    ```

    ##### **Changelog for podman**

    ```
    * Wed Jan 22 2025 Packit <hello@packit.dev> - 5:5.3.2-1
    - Update to 5.3.2 upstream release

    * Wed Jan 22 2025 Lokesh Mandvekar <lsm5@fedoraproject.org> - 5:5.3.1-4
    - remove patch merged in upcoming upstream release

    * Fri Jan 17 2025 Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> - 5:5.3.1-3
    - apply MR https://github.com/containers/storage/pull/2193

    * Wed Nov 27 2024 Lokesh Mandvekar <lsm5@fedoraproject.org> - 5:5.3.1-2
    - remove unused patch

    ```

    ----

    apply MR https://github.com/containers/storage/pull/2193




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b58b563b77 advisory.

    pam-u2f 1.3.1 includes a fix to resolve CVE-2025-23013 (Partial Authentication Bypass). CVSS score 7.3.
    1.3.2 is a fix for a regression that could impact existing use cases.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-70a32aa438 advisory.

    Includes security fixes to the crypto/x509 and net/http packages

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-50deb0acd5 advisory.

    Update to latest version

    Fix CVE-2024-53263

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-1de066b8af advisory.

    Update to latest version

    Fix CVE-2024-53263

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-29900cbe83 advisory.

    pam-u2f 1.3.1 includes a fix to resolve CVE-2025-23013 (Partial Authentication Bypass). CVSS score 7.3.
    1.3.2 is a fix for a regression that could impact existing use cases.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-82714dbb22 advisory.

    Latest stable release from upstream. Changelog: https://github.com/icculus/SDL_sound/releases/tag/v2.0.4 .
    NOTE: dr_libs are unbundled.

    Fixes:
    CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()     CVE-2023-45677: Heap buffer out of bounds write in start_decoder()     CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()     CVE-2023-45680: Null pointer dereference in vorbis_deinit()     CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()     CVE-2023-45680: Null pointer dereference in vorbis_deinit()     CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5ef10f8485 advisory.

    Latest stable release from upstream. Changelog: https://github.com/icculus/SDL_sound/releases/tag/v2.0.4 .
    NOTE: dr_libs are unbundled.

    Fixes:
    CVE-2023-45676: Multi-byte write heap buffer overflow in start_decoder()     CVE-2023-45677: Heap buffer out of bounds write in start_decoder()     CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()     CVE-2023-45680: Null pointer dereference in vorbis_deinit()     CVE-2023-45679: Attempt to free an uninitialized memory pointer in vorbis_deinit()     CVE-2023-45680: Null pointer dereference in vorbis_deinit()     CVE-2023-45682: Wild address read in vorbis_decode_packet_rest()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e45eecf53a advisory.

    Update to 2.46.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0cb4a35438 advisory.

    Update to 2.46.5

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
214992	Fedora 40 : yq (2025-93d6242840)	medium
214991	Fedora 40 : ovn (2025-721a8bada2)	high
214990	Fedora 40 : fastd (2025-29fc4fefd5)	medium
214935	Fedora 41 : fastd (2025-b895b18cfe)	medium
214934	Fedora 41 : ovn (2025-46e6440101)	high
214933	Fedora 41 : yq (2025-cd51e0177b)	medium
214932	Fedora 41 : chromium (2025-2525ddc3f2)	high
214874	Fedora 40 : buku (2025-df3432c3ee)	high
214873	Fedora 41 : buku (2025-e035838041)	high
214868	Fedora 40 : nodejs20 (2025-54958ff9e2)	high
214867	Fedora 40 : nodejs18 (2025-cc8f9d8943)	medium
214866	Fedora 41 : jpegxl (2025-6e4727185c)	high
214865	Fedora 40 : chromium (2025-82ba6b8dc5)	high
214860	Fedora 41 : nodejs18 (2025-e330d34ecc)	medium
214859	Fedora 41 : rust-routinator (2025-bbabead4d7)	high
214858	Fedora 41 : nodejs20 (2025-76fc32d433)	high
214840	Fedora 40 : phpMyAdmin (2025-c17ef0f176)	medium
214839	Fedora 41 : phpMyAdmin (2025-4b8ab3834c)	medium
214838	Fedora 41 : lemonldap-ng (2025-3aa9a75a72)	medium
214837	Fedora 40 : lemonldap-ng (2025-07901b1995)	medium
214836	Fedora 40 : expat (2024-2462a2fc4c)	high
214835	Fedora 41 : java-21-openjdk (2025-9f92cbc27f)	high
214755	Fedora 40 : golang (2025-e8b9a6b564)	high
214754	Fedora 40 : dotnet8.0 (2025-16778d3c88)	high
214753	Fedora 40 : vaultwarden (2025-3dff292265)	critical
214752	Fedora 41 : dotnet8.0 (2025-bd8f5a599b)	high
214751	Fedora 41 : libsoup3 (2025-42ee7772e3)	high
214750	Fedora 41 : abseil-cpp (2025-7631628ba6)	high
214749	Fedora 41 : dotnet9.0 (2025-2eb86c0cbf)	high
214748	Fedora 41 : vaultwarden (2025-4cb7637c98)	critical
214747	Fedora 40 : dotnet9.0 (2025-0487787cb9)	high
214656	Fedora 41 : freeipa (2025-b21777d1b5)	medium
214655	Fedora 40 : freeipa (2025-6baf694c75)	medium
214654	Fedora 41 : glibc (2025-497995b101)	high
214653	Fedora 40 : glibc (2025-69207650a4)	high
214651	Fedora 40 : chromium (2025-5d89c826ff)	high
214650	Fedora 40 : mediawiki (2025-11277f6779)	medium
214649	Fedora 41 : mediawiki (2025-25b16d6561)	medium
214648	Fedora 41 : chromium (2025-eb2f4a2306)	high
214637	Fedora 40 : rsync (2025-b28759cb95)	high
214636	Fedora 41 : buildah / containers-common / podman (2025-908dfe95f6)	high
214635	Fedora 40 : pam-u2f (2025-b58b563b77)	high
214634	Fedora 41 : golang (2025-70a32aa438)	high
214567	Fedora 40 : git-lfs (2025-50deb0acd5)	high
214566	Fedora 41 : git-lfs (2025-1de066b8af)	high
214565	Fedora 41 : pam-u2f (2025-29900cbe83)	high
214516	Fedora 41 : SDL2_sound (2025-82714dbb22)	high
214514	Fedora 40 : SDL2_sound (2025-5ef10f8485)	high
214513	Fedora 40 : webkit2gtk4.0 (2025-e45eecf53a)	high
214508	Fedora 41 : webkit2gtk4.0 (2025-0cb4a35438)	high

Detections

Analytics

Fedora Local Security Checks Family for Nessus

medium

high

medium

medium

high

medium

high

high

high

high

medium

high

high

medium

high

high

medium

medium

medium

medium

high

high

high

high

critical

high

high

high

high

critical

high

medium

medium

high

high

high

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high